M
Marc
Guest
- #1
Thread Owner:
Marc
Greetings everyone,
We are pleased to announce the release of phpBB 3.3.18 “Bertie vs. Acme”. This is an urgent update that fixes a reflected cross-site scripting (XSS) vulnerability (CVE-2026-87901). Thanks to Aikido Security for reporting this issue. We suggest you update to this new version as soon as possible. phpBB 3.3.18 also fixes several other security issues, adds further hardening, two new features and resolves some issues noticed in previous releases. For a list of all the fixed security issues including the credits, please see the release highlights below or the full changelog in the package.
Based on your feedback, we have added a new feature that will automatically notify board admins of new maintenance, security and urgent phpBB updates. We have added a distinction between security and urgent updates so that admins can easily identify updates that require immediate attention, while still being informed about other security fixes. By default, all admins will receive board and email notifications about new updates. These notification preferences can be configured under User Control Panel (UCP) > Board preferences > Edit notification options. phpBB will automatically check for new updates every hour and inform admins accordingly when there is a new version available.
Furthermore, we have improved guest session handling by adding new functionality. This should help combat potential issues when a large number of guest sessions are created, e.g. during excessive crawling by bots. Additionally, there is now a new AI Crawlers group that should allow specific handling of AI Crawlers by board admins. By default AI Crawlers will not see any board content. This can be adjusted by admins using the phpBB forum permission system.
The full list of changes is available in the changelog file within the docs folder contained in the release package. You can find the key highlights of this release below and a list of all issues fixed on our tracker at https://tracker.phpbb.com/issues/?filter=16991
The packages can be downloaded from our downloads page .
The development team thanks everyone who contributed code to this release: Matt Friedman, Prosk8er, Christian Schnegelberger, ECYaz, Daniel James, JauntyMYT
If you have any questions or comments, we'll be happy to address them in the discussion topic .
- The phpBB Team
Continue reading...
We are pleased to announce the release of phpBB 3.3.18 “Bertie vs. Acme”. This is an urgent update that fixes a reflected cross-site scripting (XSS) vulnerability (CVE-2026-87901). Thanks to Aikido Security for reporting this issue. We suggest you update to this new version as soon as possible. phpBB 3.3.18 also fixes several other security issues, adds further hardening, two new features and resolves some issues noticed in previous releases. For a list of all the fixed security issues including the credits, please see the release highlights below or the full changelog in the package.
Based on your feedback, we have added a new feature that will automatically notify board admins of new maintenance, security and urgent phpBB updates. We have added a distinction between security and urgent updates so that admins can easily identify updates that require immediate attention, while still being informed about other security fixes. By default, all admins will receive board and email notifications about new updates. These notification preferences can be configured under User Control Panel (UCP) > Board preferences > Edit notification options. phpBB will automatically check for new updates every hour and inform admins accordingly when there is a new version available.
Furthermore, we have improved guest session handling by adding new functionality. This should help combat potential issues when a large number of guest sessions are created, e.g. during excessive crawling by bots. Additionally, there is now a new AI Crawlers group that should allow specific handling of AI Crawlers by board admins. By default AI Crawlers will not see any board content. This can be adjusted by admins using the phpBB forum permission system.
The full list of changes is available in the changelog file within the docs folder contained in the release package. You can find the key highlights of this release below and a list of all issues fixed on our tracker at https://tracker.phpbb.com/issues/?filter=16991
The packages can be downloaded from our downloads page .
The development team thanks everyone who contributed code to this release: Matt Friedman, Prosk8er, Christian Schnegelberger, ECYaz, Daniel James, JauntyMYT
If you have any questions or comments, we'll be happy to address them in the discussion topic .
- The phpBB Team
Continue reading...